When a Kyverno Wildcard Guardrail Runs Past a Post-Policy CRD Until a Restart

`kinds: ["/"] + operations: [DELETE] on Kyverno v1.19.1 (crdWatcher` on): "no policies matched admission request" for a post-policy CRD's custom resource until the admission controller restarted — a pre-policy CRD's resource was denied before and after.

When It Runs — Run Report #RR05 · Testing what infrastructure actually does.

Provider · Component: Kyverno · ClusterPolicy wildcard matching (kinds: ["*/*"]) and the admission controller's policy cache

Versions tested: Kyverno v1.19.1 (current release as of the desk check, published 2026-09-10; re-confirmed as current at lab start on 2026-09-13), installed from the official Helm chart kyverno/kyverno 3.9.1 (repo https://kyverno.github.io/kyverno/); admission-controller image reg.kyverno.io/kyverno/kyverno:v1.19.1 at digest sha256:b31d8511ae5fd6010e2a01ea72ebae08eb82fa51d91af14a1d9fe989949b4edb. The documentation strings and issue/PR states were checked against the live docs and GitHub on 2026-09-12 and re-confirmed on 2026-09-13.

Config profile: A single-node kind cluster running the Kyverno v1.19.1 admission controller with crdWatcher enabled (Helm value admissionController.crdWatcher=true; the live container args included --crdWatcher=true, alongside --resyncPeriod=15m and --v=4); a wildcard ClusterPolicy; and a benign CRD (plus one of its custom resources) installed after the policy. Node Kubernetes version v1.34.0.

Verified on: 2026-09-24 (desk sources re-checked; v1.19.1 is still the current release) · lab measured 2026-09-13 on v1.19.1.

Affects: Kyverno ClusterPolicies that rely on a kinds: ["*/*"] wildcard deny rule (operations: [DELETE]) to cover CRDs installed after the policy is applied (v1.19.1, crdWatcher enabled; measured: the deletion was allowed — the guardrail did not match — until the admission controller was restarted).

TL;DR: On Kyverno v1.19.1 (Kubernetes v1.34.0, crdWatcher enabled), a kinds: ["*/*"] wildcard deny ClusterPolicy did not deny deletion of a labeled custom resource whose CRD was installed after the policy — the deletion was allowed at every poll across a ~32-minute window (past the 15-minute informer resync) and became denied only after the admission controller was restarted, while a pre-policy CRD's custom resource was denied throughout (control).

Full report: https://whenitruns.substack.com/p/when-a-kyverno-wildcard-guardrail

Reproduction repo: https://github.com/whenitruns/when-a-kyverno-wildcard-guardrail-runs-past-a-post-policy-crd-until-a-restart